Free 300-715 practice test: 30 questions with answers

ISE must join the Active Directory domain before the AD identity store can validate passwords and retrieve group data. Importing users creates copies rather than using the directory, a certificate authentication profile is for certificate-based login, and MAB authenticates devices by MAC address rather than user passwords.

A certificate authentication profile tells ISE how to validate the student's client certificate for EAP-TLS, so no passwords are needed. Password import and token servers depend on credentials the scenario avoids, and MAB uses the device MAC address rather than a personal certificate.

The RSA SecurID and RADIUS token server identity sources let ISE check a one-time token or second factor held by an external system. A certificate authentication profile checks certificates, while internal users and Active Directory check stored credentials without a separate token step.

PEAP uses a server certificate that clients validate, then carries a password-based inner method such as EAP-MSCHAPv2. EAP-TLS needs a client certificate on every device, MAB is for devices without a supplicant, and web authentication is a portal flow rather than an EAP method.

Monitor mode allows traffic while recording authentication outcomes, which lets a team measure the impact before enforcing access. Blocking traffic describes closed mode, a pre-authentication ACL describes low-impact mode, and shutting the port down after a failure is not a monitor mode behaviour.

In central web authentication, ISE sends a Change of Authorization after the guest completes the portal so the network device applies the final authorization without a reconnect. A DHCP lease change does not alter ISE authorization, an Access-Reject would deny the session, and TACACS+ authorization is for administrators of network devices.

Local web authentication keeps the login page on the network device, which validates the guest against ISE over RADIUS. Central web authentication hosts the portal on ISE, native supplicant provisioning installs supplicant settings and certificates, and posture assessment checks endpoint compliance.

The Sponsor Portal is where sponsors create, manage and approve guest accounts, including their validity period. The My Devices Portal is for employee device registration, the Hotspot Portal lets guests accept terms without credentials, and the Client Provisioning Portal delivers agents to endpoints.

Self-registration lets visitors create their own guest accounts, and requiring sponsor approval holds each request until a sponsor accepts it. Hotspot access has no approval step, help-desk accounts skip self-registration, and a local switch password is not a guest-portal approval flow.

A guest type holds the settings for guest accounts, including account duration and access options, so different visitor categories can have different validity periods. Sponsor groups control which sponsors can create which guest types, the hotspot portal does not set validity periods, and client provisioning resources install agents or supplicants.

The DHCP probe collects attributes that endpoints include in DHCP requests, which helps profile devices such as printers and phones. The SNMP trap, NetFlow and Active Directory probes gather link-state, flow and group data rather than DHCP request content.

A CoA reauthenticate request tells the network device to repeat the session's authentication so the new result applies without a reconnect. Terminating forces a manual reconnect, DHCP scope changes do not alter ISE authorization, and editing groups alone does not notify the switch.

A profiling policy classifies the endpoint and assigns it to an endpoint identity group, and authorization rules then match on that group. Profiling does not create user accounts, return VLANs directly, or install certificates on endpoints.

The DHCP probe reads attributes from DHCP requests and the NetFlow probe collects flow records, and both feed profiling decisions. Local web authentication, certificate revocation and internal endpoint are not profiler probe types, so those options are incorrect.

The BYOD redirect sends the employee to onboarding, where the device is registered and the native supplicant profile configures the supplicant and installs the certificate needed for EAP-TLS. Patch scanning belongs to posture, guest access is a different flow, and onboarding does not replace the directory password.

EAP-TLS uses the client certificate issued by the internal CA to authenticate the device, which is the usual design for BYOD onboarding. PEAP-MSCHAPv2 relies on a password, MAB uses only the MAC address, and EAP-FAST uses a protected access credential rather than a device certificate.

The My Devices Portal is where employees register and manage devices, and the ISE internal CA can issue the certificates used for EAP-TLS. The Monitoring persona does not issue certificates, native supplicant provisioning is one onboarding option rather than the only one, and the Sponsor Portal is for guest accounts.

Blocking the stolen device's endpoint record stops that device from authenticating while the employee and the other devices are unaffected. Deleting the account affects all devices, reissuing certificates to other devices is unnecessary, and a password change does not stop a device that already holds a valid certificate.

The Policy Service persona handles RADIUS and TACACS+ requests and makes authentication and authorization decisions, so adding Policy Service nodes scales access processing. Administration provides the GUI and configuration API, and Monitoring collects logs and reports, so the last option wrongly gives Monitoring an enforcement role.

The Monitoring persona collects logs and produces reports, so its outage explains the missing events and dashboards. Authentications still succeed because Policy Service nodes are separate from it, and the Administration options describe GUI or change problems that the scenario does not mention.

The Administration persona hosts the GUI and configuration API, and Policy Service nodes process RADIUS requests and make authorization decisions. Monitoring only collects logs and reports, Policy Service nodes do not have to share a host with the primary Administration node, and a standalone deployment runs all personas on one node rather than separating them.

A distributed deployment spreads the Administration, Policy Service and Monitoring personas across nodes, which allows redundant Administration and Monitoring nodes and multiple Policy Service nodes for resilience. A standalone deployment runs every persona on one node, so one failure removes both administration and authentication, and the single Policy Service option has no administration redundancy.

With no posture report, ISE redirects the session to the Client Provisioning portal so the agent can be installed and the assessment can run. Full access before assessment defeats posture, a permanent quarantine with no redirect prevents the agent from installing, and the Sponsor Portal is for guest accounts.

Posture conditions define the individual checks, such as antivirus, registry, file, service or application tests, and posture requirements group them with remediation actions. Authorization profiles return results to the device, profiling probes classify endpoints, and certificate profiles validate certificates rather than posture state.

After a successful assessment, ISE sends a CoA so the network device re-evaluates the session and applies the compliant authorization. A reboot or DHCP renewal does not change ISE's authorization decision, the agent does not control switch VLANs, and the Sponsor Portal manages guest accounts.

A posture requirement can include a remediation action, such as a message and a link, that guides the user to fix a failed check. A profiling policy classifies endpoints rather than displaying remediation, an authorization profile returns network results without a user message, and a certificate profile validates certificates rather than antivirus state.

TACACS+ separates authentication, authorization and accounting and can authorize individual commands, which suits administrator access. RADIUS combines authentication and authorization and encrypts only the password, so both RADIUS options are wrong, and the TACACS+ option that claims password-only UDP encryption is also incorrect.

A TACACS+ command set, used in a device administration authorization policy, lets ISE permit or deny individual commands for an operator. A RADIUS Filter-ID and a downloadable ACL control network access or traffic rather than CLI commands, and endpoint identity groups classify devices rather than command rights.

The shell profile, used in the device administration authorization result, sets attributes such as the privilege level returned to the device at login. Network device groups only classify devices for policy matching, identity source sequences choose directories, and endpoint identity groups classify endpoints rather than set privilege levels.

Device administration policy sets match network devices and select TACACS+ allowed protocols and authorization rules, so administrative logins are separated from network access. An extra RADIUS rule would still mix administration into network access, a posture requirement does not govern admin logins, and profiling policies classify endpoints rather than set login rules.